JOSE is a family of JSON-based standards for representing cryptographic algorithms, keys, signed content, and encrypted content. It helps independently built systems exchange protected data and makes security-library errors easier to understand. section 11.0 section 11.8
The suite separates responsibilities:
- JWA names commonly used cryptographic algorithms, such as HS256. section 11.1
- JWK represents secret, public, and private keys as JSON objects. section 11.1
- JWS represents tamper-protected content without requiring confidentiality. section 11.1
- JWE represents content protected against tampering and disclosure. section 11.1
A practical security boundary
An OAuth 2.0 resource-server API may need JOSE to process protected messages. Treat algorithm selection as a security decision: the JWS alg:none vulnerability is a known pitfall, and educational examples require production review. section 3.3 section 11.8
Figure 11.1 Relationships between the standards that are part of the JOSE suite. JOSE enables interoperability between applications that want to exchange encrypted or signed data using the JSON data format. JOSE standards are used extensively by popular security protocols such as OIDC for single sign-on.
Use the standards relationship diagram to see how JWA and JWK support JWS and JWE, and how JOSE supports interoperable signed and encrypted JSON. section 11.1
